@forgezero/agent 0.1.38 → 0.1.40

package/dist/cloudflare-bootstrap.js

@@ -130,23 +130,32 @@ async function configureCloudflareEdge(config, fetcher = fetch) {
   const tunnelAuth = { apiToken: config.tunnelApiToken?.trim() || config.apiToken };
   const dnsAuth = { apiToken: config.dnsApiToken?.trim() || config.apiToken };
   const tunnelPath = `/accounts/${config.accountId}/cfd_tunnel/${config.tunnelId}/configurations`;
-  const current = await cf(tunnelAuth, tunnelPath, {}, fetcher);
-  const existing = current.config?.ingress ?? [];
-  const catchAll = existing.filter((rule) => !("hostname" in rule));
-  const otherHosts = existing.filter((rule) => ("hostname" in rule) && rule.hostname !== config.hostname);
-  await cf(tunnelAuth, tunnelPath, {
-    method: "PUT",
-    body: JSON.stringify({ config: { ingress: [
-      { hostname: config.hostname, service: config.service },
-      ...otherHosts,
-      ...catchAll.length > 0 ? catchAll : [{ service: "http_status:404" }]
-    ] } })
-  }, fetcher);
   const dnsPath = `/zones/${config.zoneId}/dns_records`;
-  const records = await cf(dnsAuth, `${dnsPath}?type=CNAME&name=${encodeURIComponent(config.hostname)}&per_page=1000`, {}, fetcher);
+  const [current, records] = await Promise.all([
+    cf(tunnelAuth, tunnelPath, {}, fetcher),
+    cf(dnsAuth, `${dnsPath}?name=${encodeURIComponent(config.hostname)}&per_page=1000`, {}, fetcher)
+  ]);
   if (records.length > 1) {
     throw new Error(`Cloudflare DNS record for ${config.hostname} is ambiguous`);
   }
+  const existingRecord = records[0];
+  if (existingRecord && (existingRecord.type !== "CNAME" || existingRecord.name && existingRecord.name.toLowerCase() !== config.hostname.toLowerCase())) {
+    throw new Error(`Cloudflare DNS hostname ${config.hostname} is already owned by an incompatible ${existingRecord.type ?? "unknown"} record`);
+  }
+  const existing = current.config?.ingress ?? [];
+  const catchAll = existing.filter((rule) => !("hostname" in rule));
+  const otherHosts = existing.filter((rule) => ("hostname" in rule) && rule.hostname !== config.hostname);
+  const desiredIngress = [
+    { hostname: config.hostname, service: config.service },
+    ...otherHosts,
+    ...catchAll.length > 0 ? catchAll : [{ service: "http_status:404" }]
+  ];
+  if (JSON.stringify(existing) !== JSON.stringify(desiredIngress)) {
+    await cf(tunnelAuth, tunnelPath, {
+      method: "PUT",
+      body: JSON.stringify({ config: { ingress: desiredIngress } })
+    }, fetcher);
+  }
   const record = {
     type: "CNAME",
     name: config.hostname,
@@ -154,233 +163,13 @@ async function configureCloudflareEdge(config, fetcher = fetch) {
     proxied: true,
     ttl: 1
   };
-  await cf(dnsAuth, records[0] ? `${dnsPath}/${records[0].id}` : dnsPath, {
-    method: records[0] ? "PUT" : "POST",
-    body: JSON.stringify(record)
-  }, fetcher);
-}
-var exactAccountPermissionGroup = async (config, name, fetcher) => {
-  const groups = await cf(config, `/accounts/${config.accountId}/tokens/permission_groups?name=${encodeURIComponent(name)}` + "&scope=com.cloudflare.api.account", {}, fetcher);
-  const matches = groups.filter((group) => group.name === name && group.scopes?.includes("com.cloudflare.api.account") && Boolean(group.id && /^[a-f0-9]{32}$/i.test(group.id)));
-  if (matches.length !== 1) {
-    throw new Error(`Cloudflare account token permission group ${name} is ${matches.length === 0 ? "missing" : "ambiguous"}`);
-  }
-  return { id: matches[0].id, name };
-};
-async function createCloudflareAccountRuntimeToken(config, fetcher = fetch) {
-  if (!/^[a-f0-9]{32}$/i.test(config.accountId))
-    throw new Error("Cloudflare account id is invalid");
-  const name = config.name.trim();
-  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,119}$/.test(name)) {
-    throw new Error("Cloudflare account runtime-token name is invalid");
-  }
-  const permissionNames = [...new Set(config.permissionNames)];
-  if (permissionNames.length === 0)
-    throw new Error("Cloudflare account runtime token needs a permission group");
-  const permissionGroups = await Promise.all(permissionNames.map((permissionName) => exactAccountPermissionGroup(config, permissionName, fetcher)));
-  const body = {
-    name,
-    policies: [{
-      effect: "allow",
-      permission_groups: permissionGroups.map(({ id }) => ({ id })),
-      resources: { [`com.cloudflare.api.account.${config.accountId}`]: "*" }
-    }]
-  };
-  const created = await cf(config, `/accounts/${config.accountId}/tokens`, { method: "POST", body: JSON.stringify(body) }, fetcher);
-  if (!created.id || !/^[a-f0-9]{32}$/i.test(created.id) || !created.value || !/^[A-Za-z0-9._-]{40,80}$/.test(created.value)) {
-    throw new Error("Cloudflare did not return the one-time account runtime-token id and value");
-  }
-  return { id: created.id, value: created.value, name, permissionNames };
-}
-async function ensureCloudflareAccessServiceToken(config, fetcher = fetch) {
-  const name = config.name.trim();
-  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/.test(name)) {
-    throw new Error("Cloudflare Access service-token name is invalid");
-  }
-  const path = `/accounts/${config.accountId}/access/service_tokens`;
-  const tokens = await cf(config, `${path}?per_page=1000`, {}, fetcher);
-  const matches = tokens.filter((token) => token.name === name);
-  if (matches.length > 1)
-    throw new Error(`Cloudflare Access service token ${name} is ambiguous`);
-  if (matches[0]) {
-    if (!config.existing || config.existing.tokenId !== matches[0].id || config.existing.clientId !== matches[0].client_id || !config.existing.clientSecret) {
-      throw new Error(`Cloudflare Access service token ${name} exists but its one-time client secret was not supplied`);
-    }
-    return { credentials: config.existing, created: false };
-  }
-  const created = await cf(config, path, {
-    method: "POST",
-    body: JSON.stringify({ name, duration: config.duration ?? "8760h" })
-  }, fetcher);
-  if (!created.id || !created.client_id || !created.client_secret) {
-    throw new Error("Cloudflare did not return the new Access service-token secret");
-  }
-  return {
-    credentials: {
-      tokenId: created.id,
-      clientId: created.client_id,
-      clientSecret: created.client_secret
-    },
-    created: true
-  };
-}
-async function ensureCloudflareAccessPolicy(config, fetcher = fetch) {
-  const path = `/accounts/${config.accountId}/access/policies`;
-  const policies = await cf(config, `${path}?per_page=1000`, {}, fetcher);
-  const matches = policies.filter((policy2) => policy2.name === config.name);
-  if (matches.length > 1)
-    throw new Error(`Cloudflare Access policy ${config.name} is ambiguous`);
-  const desired = {
-    name: config.name,
-    decision: "non_identity",
-    include: [{ service_token: { token_id: config.serviceTokenId } }]
-  };
-  const policy = await cf(config, matches[0] ? `${path}/${encodeURIComponent(matches[0].id)}` : path, {
-    method: matches[0] ? "PUT" : "POST",
-    body: JSON.stringify(desired)
-  }, fetcher);
-  return { policy, created: !matches[0] };
-}
-async function ensureCloudflareAccessApplication(config, fetcher = fetch) {
-  const path = `/accounts/${config.accountId}/access/apps`;
-  const applications = await cf(config, `${path}?per_page=1000`, {}, fetcher);
-  const matches = applications.filter((application2) => application2.domain === config.hostname || application2.self_hosted_domains?.includes(config.hostname));
-  if (matches.length > 1)
-    throw new Error(`Cloudflare Access application for ${config.hostname} is ambiguous`);
-  const desired = {
-    name: config.name,
-    type: "self_hosted",
-    domain: config.hostname,
-    session_duration: "24h",
-    service_auth_401_redirect: true,
-    policies: [{ id: config.policyId, precedence: 1 }]
-  };
-  const application = await cf(config, matches[0] ? `${path}/${encodeURIComponent(matches[0].id)}` : path, { method: matches[0] ? "PUT" : "POST", body: JSON.stringify(desired) }, fetcher);
-  return { application, created: !matches[0] };
-}
-async function ensureCloudflareWarpEnrollmentApplication(config, fetcher = fetch) {
-  const name = config.name.trim();
-  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/.test(name)) {
-    throw new Error("Cloudflare WARP enrollment application name is invalid");
-  }
-  const path = `/accounts/${config.accountId}/access/apps`;
-  const applications = await cf(config, `${path}?per_page=1000`, {}, fetcher);
-  const matches = applications.filter((application2) => application2.type === "warp" || application2.name === name);
-  if (matches.length > 1)
-    throw new Error(`Cloudflare WARP enrollment application ${name} is ambiguous`);
-  if (matches[0] && (matches[0].type !== "warp" || matches[0].name !== name)) {
-    throw new Error(`Cloudflare Access application ${name} is not the owned WARP enrollment application`);
-  }
-  const desired = {
-    name,
-    type: "warp",
-    policies: [{ id: config.policyId, precedence: 1 }]
-  };
-  const application = await cf(config, matches[0] ? `${path}/${encodeURIComponent(matches[0].id)}` : path, { method: matches[0] ? "PUT" : "POST", body: JSON.stringify(desired) }, fetcher);
-  if (!application.id || application.type && application.type !== "warp") {
-    throw new Error("Cloudflare did not return the WARP enrollment application");
-  }
-  return { application, created: !matches[0] };
-}
-async function ensureCloudflareVirtualNetwork(config, fetcher = fetch) {
-  const name = config.name.trim();
-  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/.test(name))
-    throw new Error("Cloudflare VNET name is invalid");
-  const path = `/accounts/${config.accountId}/teamnet/virtual_networks`;
-  const networks = await cf(config, `${path}?per_page=1000`, {}, fetcher);
-  const matches = networks.filter((network) => !network.deleted_at && network.name === name);
-  if (matches.length > 1)
-    throw new Error(`Cloudflare VNET ${name} is ambiguous`);
-  if (matches[0])
-    return { virtualNetwork: matches[0], created: false };
-  const virtualNetwork = await cf(config, path, {
-    method: "POST",
-    body: JSON.stringify({ name, comment: config.comment.slice(0, 256), is_default_network: false })
-  }, fetcher);
-  if (!virtualNetwork.id || !/^[0-9a-f-]{36}$/i.test(virtualNetwork.id)) {
-    throw new Error("Cloudflare did not return the VNET id");
-  }
-  return { virtualNetwork, created: true };
-}
-async function ensureCloudflareWarpDevicePolicy(config, fetcher = fetch) {
-  const name = config.name.trim();
-  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/.test(name))
-    throw new Error("Cloudflare WARP device profile name is invalid");
-  if (!/^[A-Za-z0-9_-]{1,128}$/.test(config.serviceTokenId))
-    throw new Error("Cloudflare service-token id is invalid");
-  if (!/^[0-9a-f-]{36}$/i.test(config.virtualNetworkId))
-    throw new Error("Cloudflare VNET id is invalid");
-  const precedence = config.precedence ?? 100;
-  if (!Number.isInteger(precedence) || precedence < 1 || precedence > 999999) {
-    throw new Error("Cloudflare WARP device profile precedence is invalid");
-  }
-  const match = `identity.service_token_uuid == "${config.serviceTokenId}"`;
-  const listPath = `/accounts/${config.accountId}/devices/policies`;
-  const path = `/accounts/${config.accountId}/devices/policy`;
-  const policies = await cf(config, `${listPath}?per_page=1000`, {}, fetcher);
-  const matches = policies.filter((policy2) => policy2.name === name);
-  if (matches.length > 1)
-    throw new Error(`Cloudflare WARP device profile ${name} is ambiguous`);
-  if (matches[0]?.match && matches[0].match !== match) {
-    throw new Error(`Cloudflare WARP device profile ${name} belongs to another enrollment identity`);
-  }
-  const desired = {
-    name,
-    match,
-    precedence,
-    description: "ForgeZero non-interactive compute enrollment",
-    enabled: true,
-    allow_mode_switch: false,
-    allowed_to_leave: false,
-    auto_connect: 0,
-    switch_locked: true,
-    service_mode_v2: { mode: "warp" },
-    virtual_networks: { allowed: [config.virtualNetworkId], default: config.virtualNetworkId }
-  };
-  const policy = await cf(config, matches[0] ? `${path}/${encodeURIComponent(matches[0].id)}` : path, { method: matches[0] ? "PATCH" : "POST", body: JSON.stringify(desired) }, fetcher);
-  if (!policy.id)
-    throw new Error("Cloudflare did not return the WARP device profile id");
-  return { policy, created: !matches[0] };
-}
-async function configureCloudflareWorkerAccessSecrets(config, fetcher = fetch) {
-  if (!/^[a-z][a-z0-9-]{0,62}$/.test(config.scriptName)) {
-    throw new Error("Cloudflare Worker script name is invalid");
-  }
-  await cf(config, `/accounts/${config.accountId}/workers/scripts/${config.scriptName}/secrets-bulk`, {
-    method: "PATCH",
-    body: JSON.stringify({
-      secrets: {
-        CF_ACCESS_CLIENT_ID: {
-          name: "CF_ACCESS_CLIENT_ID",
-          type: "secret_text",
-          text: config.credentials.clientId
-        },
-        CF_ACCESS_CLIENT_SECRET: {
-          name: "CF_ACCESS_CLIENT_SECRET",
-          type: "secret_text",
-          text: config.credentials.clientSecret
-        }
-      }
-    })
-  }, fetcher);
-}
-async function ensureCloudflareKvNamespace(config, fetcher = fetch) {
-  const title = config.title.trim();
-  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(title)) {
-    throw new Error("Cloudflare KV namespace title is invalid");
+  const dnsAlreadyCorrect = existingRecord?.type === record.type && existingRecord.name?.toLowerCase() === record.name.toLowerCase() && existingRecord.content?.toLowerCase() === record.content.toLowerCase() && existingRecord.proxied === true && existingRecord.ttl === 1;
+  if (!dnsAlreadyCorrect) {
+    await cf(dnsAuth, existingRecord ? `${dnsPath}/${encodeURIComponent(existingRecord.id)}` : dnsPath, {
+      method: existingRecord ? "PUT" : "POST",
+      body: JSON.stringify(record)
+    }, fetcher);
   }
-  const path = `/accounts/${config.accountId}/storage/kv/namespaces`;
-  const namespaces = await cf(config, `${path}?per_page=1000`, {}, fetcher);
-  const matches = namespaces.filter((namespace2) => namespace2.title === title);
-  if (matches.length > 1)
-    throw new Error(`Cloudflare KV namespace ${title} is ambiguous`);
-  if (matches[0])
-    return { namespace: matches[0], created: false };
-  const namespace = await cf(config, path, {
-    method: "POST",
-    body: JSON.stringify({ title })
-  }, fetcher);
-  return { namespace, created: true };
 }
 async function ensureCloudflareTunnel(config, fetcher = fetch) {
   const name = config.name.trim();
@@ -406,11 +195,13 @@ async function ensureCloudflareTunnel(config, fetcher = fetch) {
 
 // src/cloudflare-bootstrap.ts
 import { constants } from "fs";
-import { chmod, lstat, mkdir, mkdtemp, open, rename, rm, stat, unlink } from "fs/promises";
-import { dirname, join, resolve } from "path";
-import { tmpdir } from "os";
 import { randomUUID } from "crypto";
-import { isIP as isIP2 } from "net";
+import { chmod, lstat, mkdir, open, rename, stat, unlink } from "fs/promises";
+import { dirname, join, resolve } from "path";
+var TOKEN = /^[A-Za-z0-9._-]{40,80}$/;
+var CONNECTOR_TOKEN = /^[A-Za-z0-9._-]{40,16384}$/;
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var HOSTNAME = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/;
 var ownerUid = () => typeof process.getuid === "function" ? process.getuid() : undefined;
 async function assertOwnerOnlyHandle(path, handle, maximumBytes) {
   const metadata = await handle.stat();
@@ -419,8 +210,9 @@ async function assertOwnerOnlyHandle(path, handle, maximumBytes) {
   if (metadata.nlink !== 1)
     throw new Error(`${path} must not have multiple hard links`);
   const uid = ownerUid();
-  if (uid !== undefined && uid !== 0 && metadata.uid !== uid)
+  if (uid !== undefined && uid !== 0 && metadata.uid !== uid) {
     throw new Error(`${path} must be owned by the current operator`);
+  }
   if ((metadata.mode & 63) !== 0)
     throw new Error(`${path} must not be accessible by group or other users`);
   if ((metadata.mode & 256) === 0)
@@ -445,25 +237,36 @@ async function readOwnerOnlyFile(path, maximumBytes) {
 }
 async function readOwnerApiToken(path) {
   const token = (await readOwnerOnlyFile(path, 4096)).trim();
-  if (!/^[A-Za-z0-9._-]{40,80}$/.test(token)) {
+  if (!TOKEN.test(token))
     throw new Error(`${resolve(path)} must contain exactly one Cloudflare API token`);
-  }
   return token;
 }
 async function readCloudflareBootstrapTokens(files) {
   const entries = await Promise.all([
     ["apiToken", files.apiTokenFile],
+    ["managementApiToken", files.managementApiTokenFile],
+    ["runtimeApiToken", files.runtimeApiTokenFile],
     ["tunnelApiToken", files.tunnelApiTokenFile],
     ["dnsApiToken", files.dnsApiTokenFile],
-    ["kvApiToken", files.kvApiTokenFile],
-    ["accessApiToken", files.accessApiTokenFile],
-    ["workerApiToken", files.workerApiTokenFile]
+    ["kvApiToken", files.kvApiTokenFile]
   ].map(async ([key, path]) => [key, path ? await readOwnerApiToken(path) : undefined]));
-  const tokens = Object.fromEntries(entries.filter(([, value]) => value !== undefined));
-  const unified = tokens.apiToken;
-  for (const key of ["tunnelApiToken", "dnsApiToken", "kvApiToken", "accessApiToken", "workerApiToken"]) {
-    if (!tokens[key] && !unified)
-      throw new Error(`Cloudflare ${key} file is required when --token-file is omitted`);
+  const supplied = Object.fromEntries(entries.filter(([, value]) => value !== undefined));
+  const tokens = {
+    ...supplied.apiToken ? { apiToken: supplied.apiToken } : {},
+    ...supplied.tunnelApiToken || supplied.managementApiToken ? {
+      tunnelApiToken: supplied.tunnelApiToken ?? supplied.managementApiToken
+    } : {},
+    ...supplied.dnsApiToken || supplied.managementApiToken ? {
+      dnsApiToken: supplied.dnsApiToken ?? supplied.managementApiToken
+    } : {},
+    ...supplied.kvApiToken || supplied.runtimeApiToken ? {
+      kvApiToken: supplied.kvApiToken ?? supplied.runtimeApiToken
+    } : {}
+  };
+  for (const key of ["tunnelApiToken", "dnsApiToken", "kvApiToken"]) {
+    if (!tokens[key] && !tokens.apiToken) {
+      throw new Error(`Cloudflare ${key} file is required when apiTokenFile is omitted`);
+    }
   }
   return tokens;
 }
@@ -473,36 +276,30 @@ var validateId = (value, label) => {
     throw new Error(`${label} must be a 32-character hexadecimal id`);
   return normalized;
 };
-var validateName = (value, label, maximum, allowSpaces = true) => {
+var validateName = (value, label) => {
   const normalized = value.trim();
-  const pattern = allowSpaces ? /^[A-Za-z0-9][A-Za-z0-9 ._-]*$/ : /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
-  if (!normalized || normalized.length > maximum || !pattern.test(normalized)) {
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/.test(normalized))
     throw new Error(`${label} is invalid`);
-  }
   return normalized;
 };
-var privateAddress = (value) => {
-  const address = value.trim().toLowerCase();
-  const family = isIP2(address);
-  if (family === 4) {
-    const [a, b] = address.split(".").map(Number);
-    if (a === 10 || a === 192 && b === 168 || a === 172 && b >= 16 && b <= 31)
-      return address;
+var normalizeService = (value) => {
+  let service;
+  try {
+    service = new URL(value);
+  } catch {
+    throw new Error("Cloudflare Tunnel service must be an explicit loopback HTTP port");
   }
-  if (family === 6) {
-    const first = Number.parseInt(address.split(":", 1)[0], 16);
-    if (Number.isFinite(first) && (first & 65024) === 64512)
-      return address;
+  if (service.protocol !== "http:" || !["localhost", "127.0.0.1", "[::1]"].includes(service.hostname) || !service.port || service.pathname !== "/" || service.username || service.password || service.search || service.hash) {
+    throw new Error("Cloudflare Tunnel service must be an explicit loopback HTTP port");
   }
-  throw new Error("Cloudflare private database address must be RFC 1918 IPv4 or unique-local IPv6");
+  return service.toString().replace(/\/$/, "");
 };
 function validateCloudflareBootstrapCoordinates(input) {
   const nodeInputs = input.nodes?.length ? input.nodes : [{
     nodeName: input.tunnelName,
     hostname: input.hostname,
     service: input.service,
-    tunnelName: input.tunnelName,
-    applicationName: input.applicationName
+    tunnelName: input.tunnelName
   }];
   if (nodeInputs.length < 1 || nodeInputs.length > 32) {
     throw new Error("Cloudflare bootstrap requires between 1 and 32 explicit nodes");
@@ -512,88 +309,32 @@ function validateCloudflareBootstrapCoordinates(input) {
     if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(nodeName))
       throw new Error("Cloudflare node name is invalid");
     const hostname = node.hostname.trim().toLowerCase();
-    if (!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/.test(hostname)) {
+    if (!HOSTNAME.test(hostname))
       throw new Error("Cloudflare public node hostname is invalid");
-    }
-    const serviceUrl = new URL(node.service);
-    if (serviceUrl.protocol !== "http:" || !["localhost", "127.0.0.1", "[::1]"].includes(serviceUrl.hostname) || !serviceUrl.port || serviceUrl.pathname !== "/" || serviceUrl.search || serviceUrl.hash) {
-      throw new Error("Cloudflare Tunnel service must be an explicit loopback HTTP port");
-    }
     return {
       nodeName,
       hostname,
-      service: serviceUrl.toString().replace(/\/$/, ""),
-      tunnelName: validateName(node.tunnelName, "Cloudflare Tunnel name", 100, false),
-      applicationName: validateName(node.applicationName, "Cloudflare Access application name", 100),
-      ...node.privateAddress ? { privateAddress: privateAddress(node.privateAddress) } : {}
+      service: normalizeService(node.service),
+      tunnelName: validateName(node.tunnelName, "Cloudflare Tunnel name")
     };
   });
   for (const [label, values] of [
     ["node name", nodes.map(({ nodeName }) => nodeName)],
     ["hostname", nodes.map(({ hostname }) => hostname)],
-    ["Tunnel name", nodes.map(({ tunnelName }) => tunnelName)],
-    ["Access application name", nodes.map(({ applicationName }) => applicationName)]
+    ["Tunnel name", nodes.map(({ tunnelName }) => tunnelName)]
   ]) {
     if (new Set(values).size !== values.length)
       throw new Error(`Cloudflare fleet ${label} must be unique`);
   }
   const first = nodes[0];
-  const workerScriptName = input.workerScriptName.trim();
-  if (!/^[a-z][a-z0-9-]{0,62}$/.test(workerScriptName))
-    throw new Error("Cloudflare Worker script name is invalid");
-  const workerCompatibilityDate = input.workerCompatibilityDate.trim();
-  if (!/^20\d{2}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])$/.test(workerCompatibilityDate)) {
-    throw new Error("Cloudflare Worker compatibility date is invalid");
-  }
-  const publicDomains = [...new Set(input.publicDomains.map((domain) => domain.trim().toLowerCase()))];
-  if (publicDomains.length < 1 || publicDomains.length > 10 || publicDomains.some((domain) => !/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/.test(domain) || nodes.some(({ hostname }) => hostname === domain))) {
-    throw new Error("Cloudflare Worker public domains are invalid or include the private origin hostname");
-  }
-  const workerDirectory = resolve(input.workerDirectory);
-  const workerMain = input.workerMain.trim();
-  if (!workerMain || workerMain.startsWith("/") || workerMain.split(/[\\/]/).includes("..")) {
-    throw new Error("Cloudflare Worker main must be a project-relative path");
-  }
-  const runtimeTokenNamePrefix = input.runtimeTokenNamePrefix.trim();
-  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/.test(runtimeTokenNamePrefix)) {
-    throw new Error("Cloudflare runtime-token name prefix is invalid");
-  }
-  if (input.createPrivateNetworkRuntimeToken && !input.createRuntimeTokens) {
-    throw new Error("private-network runtime token requires runtime-token creation");
-  }
-  const privateNetwork = input.privateNetwork ? {
-    warpOrganization: validateName(input.privateNetwork.warpOrganization, "Cloudflare WARP organization", 63, false).toLowerCase(),
-    virtualNetworkName: validateName(input.privateNetwork.virtualNetworkName, "Cloudflare VNET name", 100),
-    deviceProfileName: validateName(input.privateNetwork.deviceProfileName, "Cloudflare WARP device profile name", 100),
-    enrollmentApplicationName: validateName(input.privateNetwork.enrollmentApplicationName, "Cloudflare WARP enrollment application name", 100),
-    ...input.privateNetwork.deviceProfilePrecedence !== undefined ? { deviceProfilePrecedence: input.privateNetwork.deviceProfilePrecedence } : {}
-  } : undefined;
-  if (privateNetwork && (!input.createPrivateNetworkRuntimeToken || nodes.every((node) => !node.privateAddress))) {
-    throw new Error("Cloudflare private network requires its runtime token and at least one DB node private address");
-  }
-  if (!privateNetwork && nodes.some((node) => node.privateAddress)) {
-    throw new Error("Cloudflare node private addresses require privateNetwork coordinates");
-  }
   return {
     accountId: validateId(input.accountId, "Cloudflare account id"),
     zoneId: validateId(input.zoneId, "Cloudflare zone id"),
     hostname: first.hostname,
     service: first.service,
     tunnelName: first.tunnelName,
-    kvNamespaceTitle: validateName(input.kvNamespaceTitle, "Cloudflare KV namespace title", 128, false),
-    workerScriptName,
-    serviceTokenName: validateName(input.serviceTokenName, "Cloudflare Access service-token name", 100),
-    policyName: validateName(input.policyName, "Cloudflare Access policy name", 100),
-    applicationName: first.applicationName,
-    workerDirectory,
-    workerMain,
-    workerCompatibilityDate,
-    publicDomains,
-    createRuntimeTokens: input.createRuntimeTokens,
-    createPrivateNetworkRuntimeToken: input.createPrivateNetworkRuntimeToken,
-    runtimeTokenNamePrefix,
-    nodes,
-    ...privateNetwork ? { privateNetwork } : {}
+    kvNamespaceId: validateId(input.kvNamespaceId, "Cloudflare KV namespace id"),
+    nodes
   };
 }
 function planCloudflareBootstrap(input, outputPath) {
@@ -605,120 +346,18 @@ function planCloudflareBootstrap(input, outputPath) {
     outputFile: resolve(outputPath),
     coordinates,
     operations: [
-      "create or reuse one Workers KV namespace",
       "create or reuse one remotely-managed Tunnel per node and checkpoint every connector token",
-      ...coordinates.createRuntimeTokens ? [
-        "create exact-account least-privilege runtime tokens and checkpoint their one-time values"
-      ] : [],
-      "deploy the shared Worker once with the created NODES binding and stable custom domains",
-      "create or reuse one shared Access service token/policy and one self-hosted application per node",
-      ...coordinates.privateNetwork ? [
-        "create or reuse the VNET, WARP enrollment application, locked service-token device profile and exact DB host routes"
-      ] : [],
-      "write the Access client id and secret to the existing Worker as encrypted secrets",
-      "reconcile each node ingress rule and proxied CNAME only after all Access applications are ready"
+      "preflight each exact DNS hostname, refuse ambiguous or incompatible records, and update its existing CNAME or create it only when absent",
+      "reconcile each Tunnel public-hostname ingress rule to the declared loopback API service",
+      "write one node-specific handoff containing the connector token and owner-supplied KV-write token"
     ],
     secrets: [
-      "API tokens are read only from owner-only files and are never written to output",
-      "the output contains connector, Access and requested runtime credentials and is atomically written with mode 0600",
-      "the normal API process does not receive or import the management token files"
+      "API tokens are read only from owner-only files and are never placed in argv or stdout",
+      "the management token is never persisted; connector and KV runtime capabilities are atomically checkpointed with mode 0600",
+      "the normal API process receives only its KV-write token and never Tunnel or DNS management authority"
     ]
   };
 }
-var defaultWorkerCommandRunner = async ({ command, cwd, env }) => {
-  const child = Bun.spawn([...command], {
-    cwd,
-    env: { ...env },
-    stdin: "ignore",
-    stdout: "pipe",
-    stderr: "pipe"
-  });
-  const [exitCode, stdout, stderr] = await Promise.all([
-    child.exited,
-    new Response(child.stdout).text(),
-    new Response(child.stderr).text()
-  ]);
-  return { exitCode, stdout, stderr };
-};
-var inheritedWorkerEnvironment = () => {
-  const allowed = [
-    "PATH",
-    "HOME",
-    "TMPDIR",
-    "XDG_CONFIG_HOME",
-    "XDG_CACHE_HOME",
-    "SSL_CERT_FILE",
-    "SSL_CERT_DIR",
-    "NODE_EXTRA_CA_CERTS",
-    "HTTPS_PROXY",
-    "HTTP_PROXY",
-    "NO_PROXY"
-  ];
-  return Object.fromEntries(allowed.flatMap((key) => process.env[key] ? [[key, process.env[key]]] : []));
-};
-var redact = (text, secrets) => {
-  let safe = text.slice(0, 4096);
-  for (const secret of secrets)
-    if (secret)
-      safe = safe.split(secret).join("[REDACTED]");
-  return safe.trim();
-};
-async function deployCloudflareWorker(coordinates, kvNamespaceId, apiToken, runner = defaultWorkerCommandRunner) {
-  const validated = validateCloudflareBootstrapCoordinates(coordinates);
-  const workerDirectoryMetadata = await stat(validated.workerDirectory);
-  if (!workerDirectoryMetadata.isDirectory())
-    throw new Error("Cloudflare Worker directory is not a directory");
-  const workerMain = resolve(validated.workerDirectory, validated.workerMain);
-  const workerMainMetadata = await stat(workerMain);
-  if (!workerMainMetadata.isFile())
-    throw new Error("Cloudflare Worker main is not a regular file");
-  const wrangler = resolve(validated.workerDirectory, "node_modules/.bin/wrangler");
-  const wranglerMetadata = await stat(wrangler);
-  if (!wranglerMetadata.isFile())
-    throw new Error("Cloudflare Wrangler is not installed in the Worker project");
-  if (!/^[a-f0-9]{32}$/.test(kvNamespaceId))
-    throw new Error("Cloudflare KV namespace id is invalid");
-  const temporaryDirectory = await mkdtemp(join(tmpdir(), "fz-wrangler-"));
-  await chmod(temporaryDirectory, 448);
-  const configurationPath = join(temporaryDirectory, "wrangler.json");
-  try {
-    const handle = await open(configurationPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 384);
-    try {
-      await handle.writeFile(`${JSON.stringify({
-        name: validated.workerScriptName,
-        main: workerMain,
-        compatibility_date: validated.workerCompatibilityDate,
-        workers_dev: false,
-        routes: validated.publicDomains.map((pattern) => ({ pattern, custom_domain: true })),
-        observability: { enabled: true },
-        kv_namespaces: [{ binding: "NODES", id: kvNamespaceId }]
-      }, null, 2)}
-`);
-      await handle.sync();
-    } finally {
-      await handle.close();
-    }
-    const result = await runner({
-      command: [wrangler, "deploy", "--config", configurationPath],
-      cwd: validated.workerDirectory,
-      env: {
-        ...inheritedWorkerEnvironment(),
-        XDG_CONFIG_HOME: temporaryDirectory,
-        XDG_CACHE_HOME: temporaryDirectory,
-        WRANGLER_LOG_PATH: join(temporaryDirectory, "wrangler.log"),
-        CLOUDFLARE_ACCOUNT_ID: validated.accountId,
-        CLOUDFLARE_API_TOKEN: apiToken,
-        WRANGLER_SEND_METRICS: "false"
-      }
-    });
-    if (result.exitCode !== 0) {
-      const detail = redact(result.stderr || result.stdout || "no Wrangler diagnostic", [apiToken]);
-      throw new Error(`Cloudflare Worker deployment failed with exit ${result.exitCode}: ${detail}`);
-    }
-  } finally {
-    await rm(temporaryDirectory, { recursive: true, force: true });
-  }
-}
 async function readExistingOutput(path) {
   try {
     await lstat(path);
@@ -727,18 +366,26 @@ async function readExistingOutput(path) {
       return;
     throw cause;
   }
-  const text = await readOwnerOnlyFile(path, 1048576);
-  let output;
+  let parsed;
   try {
-    output = JSON.parse(text);
-  } catch {
-    throw new Error(`${resolve(path)} is not valid bootstrap JSON`);
+    parsed = JSON.parse(await readOwnerOnlyFile(path, 1048576));
+  } catch (cause) {
+    if (cause instanceof SyntaxError)
+      throw new Error(`${resolve(path)} is not valid bootstrap JSON`);
+    throw cause;
   }
+  const output = parsed;
   if (output.format !== 1 || output.kind !== "forgezero-cloudflare-bootstrap" || !output.resources) {
     throw new Error(`${resolve(path)} is not a ForgeZero Cloudflare bootstrap output`);
   }
   return output;
 }
+function cloudflareHostHandoffPath(checkpointPath, nodeName) {
+  const normalized = nodeName.trim().toLowerCase();
+  if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(normalized))
+    throw new Error("Cloudflare host handoff node name is invalid");
+  return join(`${resolve(checkpointPath)}.hosts`, `${normalized}.json`);
+}
 async function readCloudflareConnectorHandoff(checkpointPath, nodeName) {
   const output = await readExistingOutput(resolve(checkpointPath));
   if (!output || output.phase !== "complete") {
@@ -755,7 +402,7 @@ async function readCloudflareConnectorHandoff(checkpointPath, nodeName) {
     throw new Error(`Cloudflare connector handoff has no unique completed node ${normalizedNodeName}`);
   }
   const resource = matches[0];
-  if (resource.hostname !== expected.hostname || resource.service !== expected.service || resource.tunnelName !== expected.tunnelName || !resource.applicationId || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(resource.tunnelId) || !/^[A-Za-z0-9._-]{40,16384}$/.test(resource.connectorToken)) {
+  if (resource.hostname !== expected.hostname || resource.service !== expected.service || resource.tunnelName !== expected.tunnelName || !UUID.test(resource.tunnelId) || !CONNECTOR_TOKEN.test(resource.connectorToken)) {
     throw new Error(`Cloudflare connector handoff for ${normalizedNodeName} is malformed or incomplete`);
   }
   return {
@@ -766,52 +413,63 @@ async function readCloudflareConnectorHandoff(checkpointPath, nodeName) {
     connectorToken: resource.connectorToken
   };
 }
-async function readCloudflareHostHandoff(checkpointPath, nodeName) {
-  const connector = await readCloudflareConnectorHandoff(checkpointPath, nodeName);
-  const output = await readExistingOutput(resolve(checkpointPath));
-  const kv = output?.resources.runtimeTokens?.kv;
-  if (!output || output.phase !== "complete" || !/^[a-f0-9]{32}$/i.test(output.coordinates.accountId) || !/^[a-f0-9]{32}$/i.test(output.coordinates.zoneId) || !/^[a-f0-9]{32}$/i.test(output.resources.kvNamespaceId) || !kv || !/^[A-Za-z0-9._-]{40,80}$/.test(kv.value)) {
-    throw new Error("Cloudflare host handoff is missing the exact-account KV runtime capability");
+async function readCloudflareHostHandoff(handoffPath, nodeName) {
+  let parsed;
+  try {
+    parsed = JSON.parse(await readOwnerOnlyFile(handoffPath, 65536));
+  } catch (cause) {
+    if (cause instanceof SyntaxError)
+      throw new Error("Cloudflare host handoff is not valid JSON");
+    throw cause;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+    throw new Error("Cloudflare host handoff is malformed");
+  const output = parsed;
+  const unknown = Object.keys(output).filter((key) => ![
+    "format",
+    "kind",
+    "nodeName",
+    "hostname",
+    "service",
+    "tunnelId",
+    "connectorToken",
+    "accountId",
+    "zoneId",
+    "kvNamespaceId",
+    "kvRuntimeToken",
+    "privateNetworkRuntimeToken",
+    "warp"
+  ].includes(key));
+  if (unknown.length)
+    throw new Error(`Cloudflare host handoff contains unsupported field ${unknown[0]}`);
+  const normalizedNodeName = nodeName.trim().toLowerCase();
+  let service;
+  try {
+    service = normalizeService(output.service ?? "");
+  } catch {}
+  if (output.format !== 1 || output.kind !== "forgezero-cloudflare-host-handoff" || output.nodeName !== normalizedNodeName || !HOSTNAME.test(output.hostname ?? "") || !service || !UUID.test(output.tunnelId ?? "") || !CONNECTOR_TOKEN.test(output.connectorToken ?? "") || !TOKEN.test(output.kvRuntimeToken ?? "") || !/^[a-f0-9]{32}$/i.test(output.accountId ?? "") || !/^[a-f0-9]{32}$/i.test(output.zoneId ?? "") || !/^[a-f0-9]{32}$/i.test(output.kvNamespaceId ?? "")) {
+    throw new Error("Cloudflare host handoff is malformed or belongs to another node");
   }
-  const network = output.resources.runtimeTokens?.privateNetwork?.value;
-  if (network !== undefined && !/^[A-Za-z0-9._-]{40,80}$/.test(network)) {
+  if (output.privateNetworkRuntimeToken !== undefined && !TOKEN.test(output.privateNetworkRuntimeToken)) {
     throw new Error("Cloudflare host handoff private-network capability is malformed");
   }
-  const privateNetwork = output.resources.privateNetwork;
-  const access = output.resources.access;
-  if (Boolean(privateNetwork) !== Boolean(network)) {
+  if (Boolean(output.warp) !== Boolean(output.privateNetworkRuntimeToken)) {
     throw new Error("Cloudflare host handoff private-network resources and capability disagree");
   }
-  if (privateNetwork && (!access?.clientId || !access.clientSecret || !/^[A-Za-z0-9][A-Za-z0-9-]{0,62}$/.test(privateNetwork.warpOrganization) || !/^[0-9a-f-]{36}$/i.test(privateNetwork.virtualNetworkId) || !privateNetwork.deviceProfileId)) {
-    throw new Error("Cloudflare host handoff WARP enrollment is malformed");
-  }
-  return {
-    ...connector,
-    accountId: output.coordinates.accountId,
-    zoneId: output.coordinates.zoneId,
-    kvNamespaceId: output.resources.kvNamespaceId,
-    kvRuntimeToken: kv.value,
-    ...network ? { privateNetworkRuntimeToken: network } : {},
-    ...privateNetwork && access ? { warp: {
-      organization: privateNetwork.warpOrganization,
-      clientId: access.clientId,
-      clientSecret: access.clientSecret,
-      virtualNetworkId: privateNetwork.virtualNetworkId,
-      deviceProfileId: privateNetwork.deviceProfileId
-    } } : {}
-  };
+  const { format: _format, kind: _kind, ...handoff } = output;
+  return handoff;
 }
 async function prepareOwnerOutputDirectory(absolutePath) {
   const directory = dirname(absolutePath);
   await mkdir(directory, { recursive: true, mode: 448 });
-  const directoryMetadata = await stat(directory);
+  const metadata = await stat(directory);
   const uid = ownerUid();
-  if (!directoryMetadata.isDirectory() || uid !== undefined && directoryMetadata.uid !== uid || (directoryMetadata.mode & 18) !== 0) {
+  if (!metadata.isDirectory() || uid !== undefined && metadata.uid !== uid || (metadata.mode & 18) !== 0) {
     throw new Error(`bootstrap output directory ${directory} must be operator-owned and not group/other writable`);
   }
   return directory;
 }
-async function writeOwnerBootstrapOutput(path, output) {
+async function writeOwnerJson(path, output) {
   const absolute = resolve(path);
   const directory = await prepareOwnerOutputDirectory(absolute);
   const temporary = `${absolute}.${randomUUID()}.tmp`;
@@ -839,21 +497,35 @@ async function writeOwnerBootstrapOutput(path, output) {
     });
   }
 }
+async function writeOwnerBootstrapOutput(path, output) {
+  await writeOwnerJson(path, output);
+}
+async function writeCloudflareHostHandoffs(checkpointPath, output) {
+  for (const node of output.resources.nodes) {
+    const handoff = {
+      format: 1,
+      kind: "forgezero-cloudflare-host-handoff",
+      nodeName: node.nodeName,
+      hostname: node.hostname,
+      service: node.service,
+      tunnelId: node.tunnelId,
+      connectorToken: node.connectorToken,
+      accountId: output.coordinates.accountId,
+      zoneId: output.coordinates.zoneId,
+      kvNamespaceId: output.resources.kvNamespaceId,
+      kvRuntimeToken: output.resources.kvRuntimeToken
+    };
+    await writeOwnerJson(cloudflareHostHandoffPath(checkpointPath, node.nodeName), handoff);
+  }
+}
 var tokenFor = (tokens, key) => {
   const token = tokens[key]?.trim() || tokens.apiToken?.trim();
-  if (!token)
+  if (!token || !TOKEN.test(token))
     throw new Error(`Cloudflare ${key} is not configured`);
   return token;
 };
-var initialManagementToken = (tokens) => {
-  const token = tokens.apiToken?.trim();
-  if (!token) {
-    throw new Error("initial Cloudflare --token-file is required to create account-owned runtime tokens");
-  }
-  return token;
-};
 var sameCoordinates = (left, right) => JSON.stringify(left) === JSON.stringify(right);
-async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fetch, workerRunner = defaultWorkerCommandRunner) {
+async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fetch) {
   const coordinates = validateCloudflareBootstrapCoordinates(input);
   const absoluteOutput = resolve(outputPath);
   const existing = await readExistingOutput(absoluteOutput);
@@ -861,19 +533,18 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
     throw new Error("bootstrap output belongs to different Cloudflare coordinates; choose a different output file");
   }
   await prepareOwnerOutputDirectory(absoluteOutput);
-  const namespace = await ensureCloudflareKvNamespace({
-    accountId: coordinates.accountId,
-    title: coordinates.kvNamespaceTitle,
-    apiToken: tokenFor(tokens, "kvApiToken")
-  }, fetcher);
+  const kvRuntimeToken = tokenFor(tokens, "kvApiToken");
   const nodeResources = [];
   const createdNodes = [];
-  let resources;
   for (const node of coordinates.nodes) {
     const checkpointed = existing?.resources.nodes?.find(({ nodeName }) => nodeName === node.nodeName);
+    let resource;
     let created = false;
     if (checkpointed) {
-      nodeResources.push(checkpointed);
+      if (checkpointed.hostname !== node.hostname || checkpointed.service !== node.service || checkpointed.tunnelName !== node.tunnelName || !UUID.test(checkpointed.tunnelId) || !CONNECTOR_TOKEN.test(checkpointed.connectorToken)) {
+        throw new Error(`checkpointed Cloudflare node ${node.nodeName} is malformed`);
+      }
+      resource = checkpointed;
     } else {
       const tunnel = await ensureCloudflareTunnel({
         accountId: coordinates.accountId,
@@ -881,234 +552,29 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
         apiToken: tokenFor(tokens, "tunnelApiToken")
       }, fetcher);
       created = tunnel.created;
-      nodeResources.push({
-        nodeName: node.nodeName,
-        hostname: node.hostname,
-        service: node.service,
-        tunnelName: node.tunnelName,
-        tunnelId: tunnel.tunnel.id,
-        connectorToken: tunnel.connectorToken
-      });
-    }
-    createdNodes.push({ nodeName: node.nodeName, tunnel: created, application: false });
-    const firstNode = nodeResources[0];
-    resources = {
-      tunnelId: firstNode.tunnelId,
-      kvNamespaceId: namespace.namespace.id,
-      hostname: firstNode.hostname,
-      service: firstNode.service,
-      connectorToken: firstNode.connectorToken,
-      nodes: [...nodeResources],
-      ...existing?.resources.access ? { access: existing.resources.access } : {},
-      ...existing?.resources.runtimeTokens ? { runtimeTokens: existing.resources.runtimeTokens } : {},
-      ...existing?.resources.worker ? { worker: existing.resources.worker } : {},
-      ...existing?.resources.privateNetwork ? { privateNetwork: existing.resources.privateNetwork } : {}
-    };
-    await writeOwnerBootstrapOutput(absoluteOutput, {
-      format: 1,
-      kind: "forgezero-cloudflare-bootstrap",
-      phase: resources.access ? "access-token-provisioned" : "edge-resources-provisioned",
-      updatedAt: new Date().toISOString(),
-      coordinates,
-      resources
-    });
-  }
-  if (!resources)
-    throw new Error("Cloudflare fleet has no nodes");
-  if (coordinates.createRuntimeTokens && !resources.runtimeTokens) {
-    resources = {
-      ...resources,
-      runtimeTokens: { kv: await createCloudflareAccountRuntimeToken({
-        accountId: coordinates.accountId,
-        name: `${coordinates.runtimeTokenNamePrefix}-kv-runtime`,
-        permissionNames: ["Workers KV Storage Write"],
-        apiToken: initialManagementToken(tokens)
-      }, fetcher) }
-    };
-    await writeOwnerBootstrapOutput(absoluteOutput, {
-      format: 1,
-      kind: "forgezero-cloudflare-bootstrap",
-      phase: "runtime-tokens-created",
-      updatedAt: new Date().toISOString(),
-      coordinates,
-      resources
-    });
-  }
-  if (coordinates.createPrivateNetworkRuntimeToken && resources.runtimeTokens && !resources.runtimeTokens.privateNetwork) {
-    resources = {
-      ...resources,
-      runtimeTokens: {
-        ...resources.runtimeTokens,
-        privateNetwork: await createCloudflareAccountRuntimeToken({
-          accountId: coordinates.accountId,
-          name: `${coordinates.runtimeTokenNamePrefix}-private-network-runtime`,
-          permissionNames: ["Cloudflare One Networks Write", "Zero Trust Write"],
-          apiToken: initialManagementToken(tokens)
-        }, fetcher)
-      }
-    };
-    await writeOwnerBootstrapOutput(absoluteOutput, {
-      format: 1,
-      kind: "forgezero-cloudflare-bootstrap",
-      phase: "runtime-tokens-created",
-      updatedAt: new Date().toISOString(),
-      coordinates,
-      resources
-    });
-  }
-  if (!resources.worker) {
-    await deployCloudflareWorker(coordinates, namespace.namespace.id, tokenFor(tokens, "workerApiToken"), workerRunner);
-    resources = {
-      ...resources,
-      worker: {
-        scriptName: coordinates.workerScriptName,
-        publicDomains: coordinates.publicDomains,
-        deployed: true
-      }
-    };
-    await writeOwnerBootstrapOutput(absoluteOutput, {
-      format: 1,
-      kind: "forgezero-cloudflare-bootstrap",
-      phase: "worker-deployed",
-      updatedAt: new Date().toISOString(),
-      coordinates,
-      resources
-    });
-  }
-  const serviceToken = await ensureCloudflareAccessServiceToken({
-    accountId: coordinates.accountId,
-    name: coordinates.serviceTokenName,
-    apiToken: tokenFor(tokens, "accessApiToken"),
-    existing: resources.access
-  }, fetcher);
-  resources = { ...resources, access: serviceToken.credentials };
-  await writeOwnerBootstrapOutput(absoluteOutput, {
-    format: 1,
-    kind: "forgezero-cloudflare-bootstrap",
-    phase: "access-token-provisioned",
-    updatedAt: new Date().toISOString(),
-    coordinates,
-    resources
-  });
-  const policy = await ensureCloudflareAccessPolicy({
-    accountId: coordinates.accountId,
-    name: coordinates.policyName,
-    serviceTokenId: serviceToken.credentials.tokenId,
-    apiToken: tokenFor(tokens, "accessApiToken")
-  }, fetcher);
-  if (!policy.policy.id)
-    throw new Error("Cloudflare did not return the Access policy id");
-  resources = {
-    ...resources,
-    access: { ...serviceToken.credentials, policyId: policy.policy.id }
-  };
-  await writeOwnerBootstrapOutput(absoluteOutput, {
-    format: 1,
-    kind: "forgezero-cloudflare-bootstrap",
-    phase: "access-token-provisioned",
-    updatedAt: new Date().toISOString(),
-    coordinates,
-    resources
-  });
-  let privateNetworkCreated = false;
-  if (coordinates.privateNetwork && !resources.privateNetwork) {
-    const managementToken = initialManagementToken(tokens);
-    const virtualNetwork = await ensureCloudflareVirtualNetwork({
-      accountId: coordinates.accountId,
-      name: coordinates.privateNetwork.virtualNetworkName,
-      comment: "ForgeZero private database network",
-      apiToken: managementToken
-    }, fetcher);
-    const enrollment = await ensureCloudflareWarpEnrollmentApplication({
-      accountId: coordinates.accountId,
-      name: coordinates.privateNetwork.enrollmentApplicationName,
-      policyId: policy.policy.id,
-      apiToken: tokenFor(tokens, "accessApiToken")
-    }, fetcher);
-    const deviceProfile = await ensureCloudflareWarpDevicePolicy({
-      accountId: coordinates.accountId,
-      name: coordinates.privateNetwork.deviceProfileName,
-      serviceTokenId: serviceToken.credentials.tokenId,
-      virtualNetworkId: virtualNetwork.virtualNetwork.id,
-      precedence: coordinates.privateNetwork.deviceProfilePrecedence,
-      apiToken: managementToken
-    }, fetcher);
-    const routes = [];
-    for (const node of coordinates.nodes.filter((item) => item.privateAddress)) {
-      const resource = resources.nodes.find((item) => item.nodeName === node.nodeName);
-      const route = await ensureCloudflarePrivateDatabaseRoute({
-        accountId: coordinates.accountId,
-        tunnelId: resource.tunnelId,
-        privateAddress: node.privateAddress,
-        virtualNetworkId: virtualNetwork.virtualNetwork.id,
-        comment: `ForgeZero ${node.nodeName} database`,
-        apiToken: managementToken
-      }, fetcher);
-      await ensureCloudflareWarpDatabaseInclude({
-        accountId: coordinates.accountId,
-        policyId: deviceProfile.policy.id,
-        privateAddress: node.privateAddress,
-        description: `ForgeZero ${node.nodeName} database`,
-        apiToken: managementToken
-      }, fetcher);
-      routes.push({ nodeName: node.nodeName, routeId: route.route.id, privateAddress: node.privateAddress });
+      resource = { ...node, tunnelId: tunnel.tunnel.id, connectorToken: tunnel.connectorToken };
     }
-    resources = {
-      ...resources,
-      privateNetwork: {
-        warpOrganization: coordinates.privateNetwork.warpOrganization,
-        virtualNetworkId: virtualNetwork.virtualNetwork.id,
-        deviceProfileId: deviceProfile.policy.id,
-        enrollmentApplicationId: enrollment.application.id,
-        routes
-      }
-    };
-    privateNetworkCreated = virtualNetwork.created || enrollment.created || deviceProfile.created || routes.length > 0;
+    nodeResources.push(resource);
+    createdNodes.push({ nodeName: node.nodeName, tunnel: created });
+    const first2 = nodeResources[0];
     await writeOwnerBootstrapOutput(absoluteOutput, {
       format: 1,
       kind: "forgezero-cloudflare-bootstrap",
-      phase: "access-token-provisioned",
+      phase: "edge-resources-provisioned",
       updatedAt: new Date().toISOString(),
       coordinates,
-      resources
-    });
-  }
-  for (const node of coordinates.nodes) {
-    const application = await ensureCloudflareAccessApplication({
-      accountId: coordinates.accountId,
-      name: node.applicationName,
-      hostname: node.hostname,
-      policyId: policy.policy.id,
-      apiToken: tokenFor(tokens, "accessApiToken")
-    }, fetcher);
-    if (!application.application.id)
-      throw new Error(`Cloudflare did not return the Access application id for ${node.nodeName}`);
-    resources = {
-      ...resources,
-      nodes: resources.nodes.map((resource) => resource.nodeName === node.nodeName ? { ...resource, applicationId: application.application.id } : resource),
-      access: {
-        ...resources.access,
-        ...node.nodeName === coordinates.nodes[0].nodeName ? { applicationId: application.application.id } : {}
+      resources: {
+        tunnelId: first2.tunnelId,
+        kvNamespaceId: coordinates.kvNamespaceId,
+        hostname: first2.hostname,
+        service: first2.service,
+        connectorToken: first2.connectorToken,
+        kvRuntimeToken,
+        nodes: [...nodeResources]
       }
-    };
-    const createdNode = createdNodes.find(({ nodeName }) => nodeName === node.nodeName);
-    createdNode.application = application.created;
-    await writeOwnerBootstrapOutput(absoluteOutput, {
-      format: 1,
-      kind: "forgezero-cloudflare-bootstrap",
-      phase: "access-token-provisioned",
-      updatedAt: new Date().toISOString(),
-      coordinates,
-      resources
     });
   }
-  await configureCloudflareWorkerAccessSecrets({
-    accountId: coordinates.accountId,
-    scriptName: coordinates.workerScriptName,
-    credentials: serviceToken.credentials,
-    apiToken: tokenFor(tokens, "workerApiToken")
-  }, fetcher);
-  for (const node of resources.nodes) {
+  for (const node of nodeResources) {
     await configureCloudflareEdge({
       accountId: coordinates.accountId,
       zoneId: coordinates.zoneId,
@@ -1120,25 +586,29 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
       dnsApiToken: tokenFor(tokens, "dnsApiToken")
     }, fetcher);
   }
+  const first = nodeResources[0];
   const output = {
     format: 1,
     kind: "forgezero-cloudflare-bootstrap",
     phase: "complete",
     updatedAt: new Date().toISOString(),
     coordinates,
-    resources,
+    resources: {
+      tunnelId: first.tunnelId,
+      kvNamespaceId: coordinates.kvNamespaceId,
+      hostname: first.hostname,
+      service: first.service,
+      connectorToken: first.connectorToken,
+      kvRuntimeToken,
+      nodes: nodeResources
+    },
     created: {
       tunnel: createdNodes.some(({ tunnel }) => tunnel),
-      kvNamespace: namespace.created,
-      serviceToken: serviceToken.created,
-      policy: policy.created,
-      application: createdNodes.some(({ application }) => application),
-      privateNetwork: privateNetworkCreated,
-      workerDeployed: true,
       nodes: createdNodes
     }
   };
   await writeOwnerBootstrapOutput(absoluteOutput, output);
+  await writeCloudflareHostHandoffs(absoluteOutput, output);
   return output;
 }
 async function runAttendedCloudflareBootstrap(request, dependencies = {}) {
@@ -1149,41 +619,70 @@ async function runAttendedCloudflareBootstrap(request, dependencies = {}) {
       kind: "forgezero-cloudflare-bootstrap-evidence",
       phase: "planned",
       checkpointFile: plan.outputFile,
-      workerScriptName: plan.coordinates.workerScriptName,
-      publicDomains: plan.coordinates.publicDomains,
       nodes: plan.coordinates.nodes.map(({ nodeName, hostname }) => ({ nodeName, hostname }))
     };
   }
   if (!request.tokenFiles || !Object.values(request.tokenFiles).some(Boolean)) {
     throw new Error("Cloudflare apply requires owner-only management token file paths");
   }
-  if (plan.coordinates.createRuntimeTokens && !request.tokenFiles.apiTokenFile) {
-    throw new Error("Cloudflare runtime-token creation requires the initial management token file");
-  }
   const tokens = await readCloudflareBootstrapTokens(request.tokenFiles);
-  const output = await applyCloudflareBootstrap(plan.coordinates, tokens, plan.outputFile, dependencies.fetcher ?? fetch, dependencies.workerRunner);
+  const output = await applyCloudflareBootstrap(plan.coordinates, tokens, plan.outputFile, dependencies.fetcher ?? fetch);
   return {
     format: 1,
     kind: "forgezero-cloudflare-bootstrap-evidence",
     phase: "complete",
     checkpointFile: plan.outputFile,
     kvNamespaceId: output.resources.kvNamespaceId,
-    workerScriptName: output.coordinates.workerScriptName,
-    publicDomains: output.resources.worker?.publicDomains ?? output.coordinates.publicDomains,
-    runtimeTokenIds: {
-      kv: output.resources.runtimeTokens?.kv.id,
-      privateNetwork: output.resources.runtimeTokens?.privateNetwork?.id
-    },
-    nodes: output.resources.nodes.map(({ nodeName, hostname, tunnelId, applicationId }) => ({
+    nodes: output.resources.nodes.map(({ nodeName, hostname, tunnelId }) => ({
       nodeName,
       hostname,
-      tunnelId,
-      applicationId
+      handoffFile: cloudflareHostHandoffPath(plan.outputFile, nodeName),
+      tunnelId
     }))
   };
 }
+var acceptanceFetch = async (url, label, fetcher) => {
+  let response;
+  try {
+    response = await fetcher(url, { method: "GET", redirect: "manual", signal: AbortSignal.timeout(5000) });
+  } catch {
+    throw new Error(`${label} is unreachable`);
+  }
+  if (!response.ok)
+    throw new Error(`${label} returned HTTP ${response.status}`);
+  return response.status;
+};
+async function verifyCloudflareBootstrapAcceptance(checkpointPath, fetcher = fetch) {
+  const absolute = resolve(checkpointPath);
+  const output = await readExistingOutput(absolute);
+  if (!output || output.phase !== "complete")
+    throw new Error("Cloudflare acceptance requires a completed owner checkpoint");
+  const coordinates = validateCloudflareBootstrapCoordinates(output.coordinates);
+  if (output.resources.nodes.length !== coordinates.nodes.length) {
+    throw new Error("Cloudflare acceptance checkpoint does not cover the declared node fleet");
+  }
+  for (const node of output.resources.nodes) {
+    const expected = coordinates.nodes.find((candidate) => candidate.nodeName === node.nodeName);
+    if (!expected || node.hostname !== expected.hostname || node.service !== expected.service || node.tunnelName !== expected.tunnelName || !UUID.test(node.tunnelId)) {
+      throw new Error("Cloudflare acceptance checkpoint has an unbound node resource");
+    }
+  }
+  const nodes = await Promise.all(output.resources.nodes.map(async ({ nodeName, hostname }) => ({
+    nodeName,
+    hostname,
+    status: await acceptanceFetch(`https://${hostname}/api/health`, `Cloudflare origin ${nodeName}`, fetcher)
+  })));
+  return {
+    format: 1,
+    kind: "forgezero-cloudflare-bootstrap-acceptance",
+    checkpointFile: absolute,
+    verifiedAt: new Date().toISOString(),
+    nodes
+  };
+}
 export {
   writeOwnerBootstrapOutput,
+  verifyCloudflareBootstrapAcceptance,
   validateCloudflareBootstrapCoordinates,
   runAttendedCloudflareBootstrap,
   readOwnerApiToken,
@@ -1191,6 +690,6 @@ export {
   readCloudflareConnectorHandoff,
   readCloudflareBootstrapTokens,
   planCloudflareBootstrap,
-  deployCloudflareWorker,
+  cloudflareHostHandoffPath,
   applyCloudflareBootstrap
 };